This article describes how to determine the traffic rate on a device experiencing high CPU utilization, degraded performance, or packet loss. It also explains how to validate whether the observed traffic is legitimate and the recommended next steps.

You may observe one or more of the following:

• High PFE CPU utilization
• Degraded device performance
• Packet loss

Procedure

Step 1: Monitor Real-Time Interface Traffic

Use the following command to monitor traffic on all interfaces in real time:

monitor interface traffic

This command displays the current traffic rate for all interfaces in both bits per second (bps) and packets per second (pps). Monitor the output to determine the current traffic load.

Step 2: Check Interface Traffic Statistics

Run the following command to view interface statistics:

show interfaces * extensive

This command displays the current bps and pps values for each interface at the time the command is executed.

Note: Sum the bps or pps values across all interfaces to estimate the total device throughput.

Step 3: Check PFE Traffic Statistics

To view packet processing engine (PFE) traffic statistics, use:

show pfe statistics traffic

This command displays the packet rate being processed by the PFE.

Step 4: Capture Traffic for Analysis

If additional analysis is required, perform a packet capture to identify traffic patterns.

For the most accurate results, capture traffic externally on the peer interfaces of all revenue ports.

Step 5: Calculate the Traffic Rate Using Wireshark

In Wireshark, navigate to:

Statistics → Capture File Properties

The Summary section provides statistics similar to the following:

Calculate the traffic rate using the following formula:

Traffic rate = Total bytes / Total capture time (seconds)

Example

• Total bytes: 10,968
• Total capture time: 164.913 seconds

10,968 ÷ 164.913 = 66 bytes/second

The calculated value matches the average throughput reported by Wireshark.

Verification

After determining the traffic rate, verify whether the observed traffic is expected for the network.

If the Traffic Is Legitimate

• Compare the measured traffic rate with the maximum throughput supported by the platform as documented in the product datasheet.
• If the measured traffic exceeds the platform's supported capacity, recommend upgrading to a higher-capacity model.

If the Traffic Is Not Legitimate

If the traffic is excessive or unexpected, investigate the source of the traffic and implement appropriate mitigation measures.

Possible mitigation options include:

• Configure stateless firewall filters to block suspicious traffic.
• Configure security policies to block malicious IP addresses or ports.
• Enable screen options to protect the device against traffic-based attacks.

Conclusion

Determining the traffic rate helps identify whether high CPU utilization or packet loss is caused by legitimate network traffic or abnormal traffic conditions. Once the traffic profile is understood, compare it against the platform's supported capacity and take the appropriate action, such as upgrading the device or mitigating unwanted traffic.

Draft